@feigi/fleet-ctl 3.23.7 → 3.23.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.23.7",
+  "version": "3.23.9",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/cell-readout.mjs

@@ -43,7 +43,9 @@
 // `fleet-implementer-<cell>` definition was most recently added, ruled by its
 // last tier-outcomes.tsv row (a `+`-joined `ticket` field rules each ticket
 // it names); a ticket counts once however many Pulls it took. A verdict FAILS
-// the quality floor on `minted_false_claim=yes` or `closed_own_ticket=no`.
+// the quality floor on `minted_false_claim=yes` or `closed_own_ticket=no`; a
+// counted ruling holding anything but `yes` or `no` in either column, blank
+// included, is refused rather than read as a pass.
 // X is to be withdrawn once it has at least STOP.verdicts verdicts and
 // floor failures ÷ verdicts is at least STOP.failRate.
 //
@@ -56,6 +58,7 @@ import { isCLI } from "./is-cli.mjs";
 import { CELL, POLICY_CELL } from "./ledger-grammar.mjs";
 import { parseTsv as parseMemberTsv } from "./member-outcomes.mjs";
 import { parseFeatures } from "./pr-cost.mjs";
+import { VERDICT, VERDICT_COLUMNS } from "./tier-outcomes.mjs";
 
 const NAME = "cell-readout";
 export const GATE = Object.freeze({ comparisons: 10, runDates: 5 });
@@ -122,6 +125,8 @@ export function readout({ features, members }) {
  * `[{ ticket, pr, run_date, closed_own_ticket, minted_false_claim, failed }]`
  * sorted by ticket, `run_date` the ruling's; `stop` is whether the stopping
  * rule withdraws the cell. `verdicts` are parsed tier-outcomes.tsv rows.
+ * Throws on a counted ruling whose `closed_own_ticket` or `minted_false_claim`
+ * is not `yes` or `no`.
  */
 export function stoppingRule({ features, members, verdicts, added }) {
   const byKey = new Map(members.map((m) => [key(m.session, m.agent), m]));
@@ -132,6 +137,9 @@ export function stoppingRule({ features, members, verdicts, added }) {
     const tickets = judged.get(p.chosen_cell);
     if (!tickets || p.run_date < added[p.chosen_cell] || !ruling.has(p.ticket) || !admissibleMember(p, byKey)) continue;
     const v = ruling.get(p.ticket);
+    for (const c of VERDICT_COLUMNS) {
+      if (!VERDICT.includes(v[c])) throw new Error(`ticket #${p.ticket} (PR #${v.pr}): ${c} is '${v[c]}', expected yes or no`);
+    }
     const failed = v.minted_false_claim === "yes" || v.closed_own_ticket === "no";
     tickets.set(p.ticket, {
       ticket: p.ticket, pr: v.pr, run_date: v.run_date,

package/scripts/cell-readout.test.mjs

@@ -441,3 +441,31 @@ test("stopping rule: a ticket counts once, judged by its last tier-outcomes row,
   assert.equal(at.verdicts.find((v) => v.ticket === second.ticket).failed, true);
   assert.equal(at.stop, true);
 });
+
+// A verdict that is neither `yes` nor `no` matches neither floor half, so read
+// as a pass it would lower the failure rate and keep the cell alive unreported.
+test("stopping rule: a counted ruling whose closed_own_ticket or minted_false_claim is not exactly yes or no is refused, naming the ticket", () => {
+  for (const [col, value] of [["closed_own_ticket", "No"], ["minted_false_claim", "YES"], ["closed_own_ticket", ""], ["minted_false_claim", ""], ["closed_own_ticket", "yes "]]) {
+    const w = world();
+    addVerdicts(w, "smol-high", 10, 0);
+    const bad = w.verdicts[3];
+    bad[col] = value;
+    assert.throws(() => judged(w, { "smol-high": "2026-09-01" }, "smol-high"),
+      new RegExp(`ticket #${bad.ticket} \\(PR #${bad.pr}\\): ${col} is '${value}', expected yes or no`), `${col}=${JSON.stringify(value)}`);
+  }
+});
+
+// What the refusal must ACCEPT: a malformed ruling on a ticket the rule does not
+// count, and every yes/no combination on one it does.
+test("stopping rule: a malformed ruling on a ticket with no counted Pull is not read, and all four yes/no pairs are", () => {
+  const w = world();
+  addVerdicts(w, "smol-high", 4, 0);
+  [["yes", "no"], ["yes", "yes"], ["no", "no"], ["no", "yes"]].forEach(([closed, minted], i) => {
+    Object.assign(w.verdicts[i], { closed_own_ticket: closed, minted_false_claim: minted });
+  });
+  w.verdicts.push(verdict({ ticket: "1381", pr: "1392", closed_own_ticket: "", minted_false_claim: "" }));
+  w.verdicts.push(verdict({ ticket: "7", pr: "8", closed_own_ticket: "No", minted_false_claim: "YES" }));
+  const at = judged(w, { "smol-high": "2026-09-01" }, "smol-high");
+  assert.equal(at.verdicts.length, 4);
+  assert.deepEqual(at.verdicts.map((v) => v.failed), [false, true, true, true]);
+});

package/scripts/reap-cherry-check-prose.test.mjs

@@ -0,0 +1,80 @@
+// reap.sh's branch sweep runs more checks than `git cherry` before its
+// `git update-ref --no-deref -d`: the worktree registry and listing checks,
+// the dirty check, the `worktree remove` refusal and the `wt_holding` re-read
+// can each keep the branch. The cherry check is the only one of them that
+// asks whether the tip is merged, so a comment saying the delete is
+// "authorized by this check and by nothing else" is false as written. The
+// component doc said reap deletes with `-D`; it deletes with `update-ref -d`.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { bullet, paragraph, phrase, runAbove, stripHashGutter } from "./prose-pin.mjs";
+
+const REPO = join(import.meta.dirname, "..", "..");
+const SCRIPT = readFileSync(join(REPO, "plugin", "scripts", "reap.sh"), "utf8");
+const DOC = readFileSync(join(REPO, "docs", "components", "reaping-and-liveness.md"), "utf8");
+
+// The comment block above the branch sweep's cherry probe, and the one above
+// its cherry scan: the two blocks that justify why the cherry check fails
+// closed.
+const probeComment = () =>
+  stripHashGutter(runAbove(SCRIPT, 'if ! cherry=$(git cherry "$base_rev" "$tip"', "reap.sh cherry probe", "#"));
+const scanComment = () =>
+  stripHashGutter(
+    runAbove(SCRIPT, `if ! grep_probe "$cherry" '^+'; then keep "$b"`, "reap.sh cherry scan", "#"),
+  );
+
+const NOTHING_ELSE = phrase("authorized by this check and by nothing else");
+
+for (const [name, comment] of [
+  ["cherry-probe", probeComment],
+  ["cherry-scan", scanComment],
+]) {
+  test(`reap.sh: the ${name} comment does not call the cherry check the delete's sole authorizer`, () => {
+    assert.doesNotMatch(
+      comment(),
+      NOTHING_ELSE,
+      `reap.sh's ${name} comment says the delete is authorized by the cherry check and by nothing else — the worktree checks and \`wt_holding\` can stop the delete too`,
+    );
+  });
+}
+
+test("reap.sh: the cherry-probe comment does not quote the retired \"By nothing else\" sentence", () => {
+  assert.doesNotMatch(
+    probeComment(),
+    phrase('"By nothing else" bounds'),
+    "reap.sh's cherry-probe comment says \"By nothing else\" bounds what ELSE authorizes the delete — the worktree checks and `wt_holding` can stop the delete too, and the sentence restates the sole-authorizer claim",
+  );
+});
+
+test("reap.sh: the cherry comments still say why an unanswerable probe must keep", () => {
+  // Input the pins above must ACCEPT: the fail-closed argument the old
+  // sentence carried survives, restated as what makes the cherry check
+  // unique — it is the only check that asks whether the tip is merged.
+  assert.match(probeComment(), phrase("this is the only one that asks whether `$tip` is merged"));
+  assert.match(probeComment(), phrase("never a `$tip` that is unmerged — so an unanswerable probe must KEEP"));
+  assert.match(scanComment(), phrase("no check between here and the delete below asks whether the branch is merged"));
+});
+
+const reapStep = () =>
+  bullet(DOC, "1. **Reap after every merge pass**", "2. **Release a claim", "reaping-and-liveness.md reap step");
+// The doc's last list item, so the blank-line bound is the end of the file.
+const reapAndRelease = () =>
+  paragraph(
+    DOC,
+    "- **Reap and release are two different scripts on purpose.**",
+    "reaping-and-liveness.md reap-and-release choice",
+  );
+
+test("reaping-and-liveness.md: the reap step names the delete as a compare-and-swap `update-ref -d`, not `-D`", () => {
+  const step = reapStep();
+  assert.match(step, phrase("compare-and-swap `git update-ref -d`"));
+  assert.doesNotMatch(step, /`-D`/, "reaping-and-liveness.md's reap step says the delete is `-D` — reap.sh deletes with `git update-ref -d`");
+});
+
+test("reaping-and-liveness.md: the reap-and-release choice names reap's delete as `update-ref -d`, not `-D`", () => {
+  const choice = reapAndRelease();
+  assert.match(choice, phrase("Reap authorizes a destructive `git update-ref -d`"));
+  assert.doesNotMatch(choice, /`-D`/, "reaping-and-liveness.md says reap authorizes a `-D` — reap.sh deletes with `git update-ref -d`");
+});

package/scripts/reap.sh

@@ -938,23 +938,26 @@ for b in $gone_branches; do
   # enough) prints nothing, grep sees empty input and exits 1 — the identical
   # verdict a genuinely clean cherry produces, so "merged" is indistinguishable
   # from "the probe could not answer". An unmerged branch is never the ambiguous
-  # one: its `+` line makes grep exit 0 and always keeps. The delete is
-  # authorized by this check and by nothing else — its compare-and-swap refuses
-  # a ref that moved off `$tip`, never a `$tip` that is unmerged — so an
-  # unanswerable probe must KEEP, the same fail-closed shape the worktree
-  # `status` check below already uses.
+  # one: its `+` line makes grep exit 0 and always keeps. Of the checks that
+  # must pass before the delete, this is the only one that asks whether `$tip`
+  # is merged — the worktree checks below and the `worktree remove` refusal
+  # can each keep the branch, but none of them looks at its commits, and the
+  # compare-and-swap refuses a ref that moved off `$tip`, never a `$tip` that
+  # is unmerged — so an unanswerable probe must KEEP, the same fail-closed
+  # shape the worktree `status` check below already uses.
   # `refs/heads/$b`, never a bare `$b`, where the tip is read above. Restoring
   # the bare name makes a branch that shares its name with a tag ambiguous AS A
   # REV again, and git resolves an ambiguous one by preferring refs/tags/ over
   # refs/heads/ (measured, git 2.50.1 Apple Git-155). This probe would then
   # answer about the TAG's commit while the delete below removes the BRANCH —
   # and a tag sitting on a merged commit reports clean for a branch whose
-  # commits exist nowhere else. The delete is authorized by this check and by
-  # nothing else, so that reads straight through to destroying them: measured
-  # on a fixture, the enumeration fix alone turned a branch this script
-  # currently KEEPS into `REAPED`, at exit 0, with an empty kept[]. Qualifying
-  # changes nothing for an ordinary branch — both spellings name the same
-  # commit — and it is the same key the worktree lookup below already builds.
+  # commits exist nowhere else. No other check before the delete asks whether
+  # those commits are merged, so that reads straight through to destroying
+  # them: measured on a fixture, the enumeration fix alone turned a branch
+  # this script currently KEEPS into `REAPED`, at exit 0, with an empty
+  # kept[]. Qualifying changes nothing for an ordinary branch — both spellings
+  # name the same commit — and it is the same key the worktree lookup below
+  # already builds.
   #
   # `$base_rev` is the other side of the same rule, and it was missing until
   # #924: `$base` reached this `git cherry` exactly as BASE_REF spelled it, so a
@@ -963,10 +966,10 @@ for b in $gone_branches; do
   # deleted the BRANCH — measured, an unmerged [gone] branch whose commit
   # existed nowhere else REAPED at exit 0 with an empty kept[]. The
   # qualification is built at the top of the file, where its own comment
-  # records why the accept-list beside it is what makes prefixing sound. "By
-  # nothing else" bounds what ELSE authorizes the delete, not whether this
-  # check itself can be wrong — which is why BOTH revs it consumes are
-  # qualified. #634
+  # records why the accept-list beside it is what makes prefixing sound. Being
+  # the only merge check bounds what ELSE could catch an unmerged branch, not
+  # whether this check itself can be wrong — which is why BOTH revs it
+  # consumes are qualified. #634
   if ! cherry=$(git cherry "$base_rev" "$tip" 2>&1); then
     keep "$b" "cherry probe failed — cannot tell if merged: $(printf '%s' "$cherry" | tr '\n' ' ')"
     continue
@@ -981,9 +984,9 @@ for b in $gone_branches; do
   # What "grep's is the only status left to take" missed, and what this shape
   # exists for: taking it is not the same as READING it. grep answers three
   # ways, and until #1419 the `if` had two arms — an rc 2 scan that never
-  # examined `$cherry` fell into the merged arm, and the delete below is
-  # authorized by this check and by nothing else. So the deletion went ahead on
-  # a merge status no tool had established. `grep_probe` splits the two
+  # examined `$cherry` fell into the merged arm, and no check between here and
+  # the delete below asks whether the branch is merged. So the deletion went
+  # ahead on a merge status no tool had established. `grep_probe` splits the two
   # questions; the answers are ruled on here, in the order that makes the
   # unanswerable case fail CLOSED like every other could-not-check in this
   # file: scan first, verdict second.

package/scripts/ticket-router.test.mjs

@@ -660,7 +660,7 @@ test("--check stays green when a verdict or member row lands after the fit, for
   const fitted = readFileSync(p.table, "utf8");
   assert.equal(JSON.parse(fitted).fitted_through, "2026-10-01");
   // The ruling lands later and flips the ticket to a failure, and a fix round books against it.
-  writeFileSync(p.verdicts, tsv(VERDICT_COLUMNS, [verdictRow({ pr: "11", ticket: "1" }), verdictRow({ run_date: "2026-10-09", pr: "11", ticket: "1", minted_false_claim: "yes" })], true));
+  writeFileSync(p.verdicts, `# ${tsv(VERDICT_COLUMNS, [verdictRow({ pr: "11", ticket: "1" }), verdictRow({ run_date: "2026-10-09", pr: "11", ticket: "1", minted_false_claim: "yes" })], true)}`);
   writeFileSync(p.members, tsv(MEMBER_COLUMNS, [...members, { run_date: "2026-10-09", agent: "fix-pr-11", member: "fix-pr-11", ticket: "1", pr: "11" }].map(memberRow), true));
   const r = cli(["--check", ...p.fitArgs]);
   assert.equal(r.status, 0, r.stderr);

package/scripts/tier-outcomes.mjs

@@ -63,7 +63,8 @@ const LEDGER_SCRIPT = join(SCRIPT_DIR, "ledger.mjs");
 
 // ---------------------------------------------------------------------------
 // pure core — exercised through the CLI by tier-outcomes.test.mjs; only
-// COLUMNS and TIER_SWITCH_DATE are imported directly, the rest through argv
+// COLUMNS, LEGACY_WIDTH and TIER_SWITCH_DATE are imported directly, the rest
+// through argv
 // ---------------------------------------------------------------------------
 
 // APPENDED TO, never inserted into: every awk read-out in the file's header
@@ -81,6 +82,11 @@ export const TIER_SWITCH_DATE = "2026-09-29";
 
 const DATE = /^\d{4}-\d{2}-\d{2}$/;
 const BASE_DEFINITION = "fleet-implementer";
+// The two quality-floor columns `append` writes. Every reader fails the floor
+// on exactly `minted_false_claim=yes` or `closed_own_ticket=no`, so any other
+// spelling would read as a pass.
+export const VERDICT = Object.freeze(["yes", "no"]);
+export const VERDICT_COLUMNS = Object.freeze(["closed_own_ticket", "minted_false_claim"]);
 
 // `fleet-implementer` -> `default`, `fleet-implementer-<x>` -> `<x>`, anything
 // else (a generic `task`, a blank pre-#1066 subagent_type) -> null.
@@ -94,6 +100,11 @@ export function shortName(definition) {
 // Data rows as objects keyed by COLUMNS, plus the raw `line`. A row of any
 // width but the legacy or the full one is refused: a tab typed into `note`
 // shifts every field after it, and a reader keyed by position cannot tell.
+// So is a verdict column holding anything but `yes`, `no` or blank — blank
+// because a row backfilled without a ruling leaves both empty, so a row with
+// exactly one of the two blank is refused too: it was never written whole, and
+// a blanked `closed_own_ticket=no` or `minted_false_claim=yes` would read as a
+// pass.
 export function parseTierOutcomes(text) {
   return String(text ?? "").split("\n")
     .filter((l) => l.trim() && !l.startsWith("#"))
@@ -104,6 +115,15 @@ export function parseTierOutcomes(text) {
       }
       const row = { line };
       COLUMNS.forEach((c, i) => { row[c] = cells[i] ?? ""; });
+      for (const c of VERDICT_COLUMNS) {
+        if (row[c] !== "" && !VERDICT.includes(row[c])) {
+          throw new Error(`malformed row: ${c} is '${row[c]}', expected yes, no or blank — ${line.slice(0, 60)}`);
+        }
+      }
+      const [first, second] = VERDICT_COLUMNS;
+      if ((row[first] === "") !== (row[second] === "")) {
+        throw new Error(`malformed row: ${first} is '${row[first]}' but ${second} is '${row[second]}', expected both blank or both yes or no — ${line.slice(0, 60)}`);
+      }
       return row;
     });
 }
@@ -388,8 +408,8 @@ function append(pr, paths) {
   for (const [col, value] of Object.entries(fields)) {
     if (/[\t\r\n]/.test(value)) die(`--${col.replaceAll("_", "-")} holds a tab or newline — it would shift every field after it`);
   }
-  for (const col of ["closed_own_ticket", "minted_false_claim"]) {
-    if (!["yes", "no"].includes(fields[col])) die(`--${col.replaceAll("_", "-")} must be yes or no, got '${fields[col]}'`);
+  for (const col of VERDICT_COLUMNS) {
+    if (!VERDICT.includes(fields[col])) die(`--${col.replaceAll("_", "-")} must be yes or no, got '${fields[col]}'`);
   }
   if (fields.sizing && !["light", "heavy"].includes(fields.sizing)) die(`--sizing must be light or heavy, got '${fields.sizing}'`);
   for (const col of ["loc", "files"]) {

package/scripts/tier-outcomes.test.mjs

@@ -10,7 +10,7 @@ import { mkdtempSync, mkdirSync, rmSync, writeFileSync, readFileSync, existsSync
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { COLUMNS, TIER_SWITCH_DATE } from "./tier-outcomes.mjs";
+import { COLUMNS, LEGACY_WIDTH, TIER_SWITCH_DATE } from "./tier-outcomes.mjs";
 import { COLUMNS as MEMBER_COLUMNS } from "./member-outcomes.mjs";
 import { writeExecStub } from "./exec-stub.mjs";
 
@@ -29,8 +29,8 @@ function memberRow({ member, ticket, type, role = "implementer" }) {
   return MEMBER_COLUMNS.map((c) => r[c]).join("\t");
 }
 
-function tierRow({ date = TIER_SWITCH_DATE, pr, ticket, tier }) {
-  return [date, pr, ticket, "routine", tier, "yes", "no", "a note with spaces", "light", "production", "40", "2"].join("\t");
+function tierRow({ date = TIER_SWITCH_DATE, pr, ticket, tier, closed = "yes", minted = "no" }) {
+  return [date, pr, ticket, "routine", tier, closed, minted, "a note with spaces", "light", "production", "40", "2"].join("\t");
 }
 
 function ledgerText(rows = [], dispatched = []) {
@@ -275,6 +275,24 @@ test("append: --class is refused as an unknown flag before anything is written",
   assert.deepEqual(f.ghCalls(), [], "refused before gh was asked");
 });
 
+test("append: a verdict that is not exactly yes or no is refused naming the flag, before gh is asked or anything is written", (t) => {
+  for (const [flag, closed, minted] of [
+    ["closed-own-ticket", "YES", "no"],
+    ["closed-own-ticket", "yes ", "no"],
+    ["minted-false-claim", "yes", "No"],
+    ["minted-false-claim", "yes", "maybe"],
+  ]) {
+    const f = fixture(t, { members: [{ member: "impl-10", ticket: 10, type: "fleet-implementer" }] });
+    const before = readFileSync(f.tier, "utf8");
+    const r = f.run("append", "20", "--closed-own-ticket", closed, "--minted-false-claim", minted, "--note", "n");
+    const got = flag === "closed-own-ticket" ? closed : minted;
+    assert.equal(r.code, 2, `${flag}=${JSON.stringify(got)}\n${r.stdout}${r.stderr}`);
+    assert.ok(r.stderr.includes(`--${flag} must be yes or no, got '${got}'`), r.stderr);
+    assert.equal(readFileSync(f.tier, "utf8"), before);
+    assert.deepEqual(f.ghCalls(), [], "refused before gh was asked");
+  }
+});
+
 // ---------------------------------------------------------------------------
 // check
 // ---------------------------------------------------------------------------
@@ -467,6 +485,65 @@ test("check: a missing tier-outcomes.tsv file fails loudly instead of passing 0
   assert.match(r.stderr, /no .*tier-outcomes\.tsv — no rows to check/);
 });
 
+// Every reader of the file judges the floor as `minted_false_claim === "yes" ||
+// closed_own_ticket === "no"`, so any other spelling would read as a pass.
+test("check: a verdict column that is not yes, no or blank is refused as malformed, on full and legacy rows", (t) => {
+  for (const [col, row] of [
+    ["closed_own_ticket", tierRow({ pr: 21, ticket: 11, tier: "default", closed: "No" })],
+    ["minted_false_claim", tierRow({ pr: 21, ticket: 11, tier: "default", minted: "YES" })],
+    ["minted_false_claim", tierRow({ pr: 21, ticket: 11, tier: "default", minted: "no " })],
+    ["closed_own_ticket", tierRow({ date: PRE_SWITCH, pr: 21, ticket: 11, tier: "opus", closed: "y" }).split("\t").slice(0, LEGACY_WIDTH).join("\t")],
+  ]) {
+    const f = fixture(t, {
+      members: [{ member: "impl-10", ticket: 10, type: "fleet-implementer" }],
+      tierRows: [tierRow({ pr: 20, ticket: 10, tier: "default" }), row],
+    });
+    const r = f.run("check");
+    assert.equal(r.code, 2, `${row}\n${r.stdout}${r.stderr}`);
+    const value = row.split("\t")[COLUMNS.indexOf(col)];
+    assert.ok(r.stderr.includes(`malformed row: ${col} is '${value}', expected yes, no or blank`), r.stderr);
+    assert.equal(r.stdout, "");
+  }
+});
+
+// What the refusal must ACCEPT: the committed file carries never-ruled rows
+// with both verdict columns blank, and every reader parses the whole file.
+test("check: blank verdict columns and every yes/no pair parse, on full and legacy rows", (t) => {
+  const f = fixture(t, {
+    members: [{ member: "impl-10", ticket: 10, type: "fleet-implementer" }],
+    tierRows: [
+      tierRow({ date: PRE_SWITCH, pr: 19, ticket: 9, tier: "", closed: "", minted: "" }).split("\t").slice(0, LEGACY_WIDTH).join("\t"),
+      tierRow({ pr: 20, ticket: 10, tier: "default", closed: "", minted: "" }),
+      tierRow({ pr: 21, ticket: 10, tier: "default", closed: "yes", minted: "yes" }),
+      tierRow({ pr: 22, ticket: 10, tier: "default", closed: "no", minted: "no" }),
+      tierRow({ pr: 23, ticket: 10, tier: "default", closed: "no", minted: "yes" }),
+    ],
+  });
+  const r = f.run("check");
+  assert.equal(r.code, 0, r.stdout + r.stderr);
+  assert.match(r.stdout, /4 checked, 0 failed/);
+});
+
+// A row with ONE verdict column blank is what a hand-edit leaves when it blanks
+// a failing value; `append` never writes it and a no-ruling backfill blanks both.
+test("check: a row with exactly one verdict column blank is refused as malformed, on full and legacy rows", (t) => {
+  for (const [closed, minted] of [["", "no"], ["", "yes"], ["yes", ""], ["no", ""]]) {
+    for (const legacy of [false, true]) {
+      const full = tierRow({ date: legacy ? PRE_SWITCH : TIER_SWITCH_DATE, pr: 21, ticket: 11, tier: "default", closed, minted });
+      const row = legacy ? full.split("\t").slice(0, LEGACY_WIDTH).join("\t") : full;
+      const f = fixture(t, {
+        members: [{ member: "impl-10", ticket: 10, type: "fleet-implementer" }],
+        tierRows: [tierRow({ pr: 20, ticket: 10, tier: "default" }), row],
+      });
+      const r = f.run("check");
+      const label = `${JSON.stringify({ closed, minted, legacy })}\n${r.stdout}${r.stderr}`;
+      assert.equal(r.code, 2, label);
+      assert.ok(r.stderr.includes(`malformed row: closed_own_ticket is '${closed}' but minted_false_claim is '${minted}', expected both blank or both yes or no`), label);
+      assert.equal(r.stdout, "");
+    }
+  }
+});
+
 test("check --live: warns on each reviewed PR with no row, and the warning alone never fails", (t) => {
   const f = fixture(t, {
     members: [{ member: "impl-10", ticket: 10, type: "fleet-implementer" }],